Spring Security+MVC annotations Illegal argument exception
spring-annotations, spring-mvc, spring-security
Solution
Move
<security:global-method-security secured-annotations="enabled" />
from spring-security.xml to the xml file referenced by the main dispatcher servlet, usually something like servlet-context.xml or application-context.xml
See here http://static.springsource.org/spring-security/site/faq/faq.html#faq-method-security-in-web-context
Also, I think you need to add ' proxy-target-class="true" ' to the global-method-security annotation as well like
<security:global-method-security secured-annotations="enabled" proxy-target-class="true"/>
Problem
I'm using spring MVC and spring security. I have annotation-driven controller and trying to add security annotations to it. Controller code: ``` @Controller public class SomeController implements MessageSourceAware { @Secured("ROLE_ADMIN") @RequestMapping(value = "/somepage", method = RequestMethod.GET) public String getPage(HttpServletRequest request, ModelMap model) { // logic return ADMIN_VIEW_NAME; } ``` My `spring-security.xml`: ``` <?xml version="1.0" encoding="UTF-8"?> <beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:security="http://www.springframework.org/schema/security" xsi:schemaLocation=" http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.1.xsd http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd"> <security:global-method-security secured-annotations="enabled" /> <security:http auto-config="true" use-expressions="true" access-denied-page="/denied"> <security:intercept-url pattern="/login" access="permitAll"/> <!--<security:intercept-url pattern="/admin" access="hasRole('ROLE_ADMIN')"/>--> <security:form-login login-page="/login" authentication-failure-url="/login?error=true" default-target-url="/index"/> <security:logout invalidate-session="true" logout-success-url="/login" logout-url="/logout"/> </security:http> <!-- Declare an authentication-manager to use a custom userDetailsService --> <security:authentication-manager> <security:authentication-provider user-service-ref="authManager"> <security:password-encoder ref="passwordEncoder"/> </security:authentication-provider> </security:authentication-manager> <!-- Use a SHA encoder since the user's passwords are stored as SHA in the database --> <bean class="org.springframework.security.authentication.encoding.ShaPasswordEncoder" id="passwordEncoder"/> <!-- A custom service where Spring will retrieve users and their corresponding access levels --> <bean id="authManager" class="some.package.AdminManager"/> </beans> ``` When I try open secured page I get following error: ``` org.springframework.web.util.NestedServletException: Request processing failed; nested exception is java.lang.IllegalArgumentException: object is not an instance of declaring class HandlerMethod details: Controller [$Proxy139] Method [public java.lang.String SomeController.getPage(javax.servlet.http.HttpServletRequest,org.springframework.ui.ModelMap)] Resolved arguments: [0] [type=org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestWrapper] [value=SecurityContextHolderAwareRequestWrapper[ FirewalledRequest[ org.apache.catalina.connector.RequestFacade@7a31c825]]] [1] [type=org.springframework.validation.support.BindingAwareModelMap] [value={}] ``` If I remove secured annotation and uncomment following line in `spring-security.xml`: ``` <security:intercept-url pattern="/admin" access="hasRole('ROLE_ADMIN')"/> ``` Everything works fine. Thank you for any help.